ChainWatch scores MCP tool-call sequences with an HMM against a six-stage kill chain, because each call looks benign alone

arXiv 2607.19432·low signalXBlueskyLinkedInCopy link

Published July 20, ChainWatch targets the gap where per-call inspection passes but the sequence is the attack: it maps MCP tool invocations onto a six-stage kill chain and applies a Hidden Markov Model over the session's call sequence, firing detection rules when a session progresses across multiple stages. It is demonstrated on five representative attack scenarios from the security literature. Treat this as a design pattern to borrow rather than a validated tool — the paper does not publish precision, recall, or latency figures, so the sequence-level framing is the takeaway, not the numbers.